nRF Cloud multi-service - nRF Cloud connections fail with "MQTT input error: 128" and "Device not authenticated" errors

[zpm1066]

Hi,

After successful provisioning using "nRF Cloud Multi-service", I can view device on my nRF Cloud account. It shows successful MQTT and CoAP connections and GPS tracking. However, when attempting subsequent MQTT or CoAP connections, I get the errors below.

Connection to the LTE-M network is fine but attempts to connect to nRF Cloud throws "MQTT input error: 128" for MQTT and "Device not authenticated" error for CoAP.

I'm running nRF Connect SDK v2.9.0 and using the latest version of "nRF Cloud Multi-service".

Here are the MQTT and CoAP logs (IMEI masked out):

MQTT with no overlay option:

*** Booting My Application v2.1.0-dev-12e5ee106034 ***
*** Using nRF Connect SDK v2.9.0-7787b2649840 ***
*** Using Zephyr OS v3.7.99-1f8f3dc29142 ***
I: Starting bootloader
I: Primary image: magic=bad, swap_type=0x1, copy_done=0x2, image_ok=0x2
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Image index: 0, Swap type: none
I: Bootloader chainload address offset: 0x10000
[00:00:00.253,417] <inf> spi_nor: gd25wb256e3ir@0: 32 MiBy flash
*** Booting nRF Connect SDK v2.9.0-7787b2649840 ***
*** Using Zephyr OS v3.7.99-1f8f3dc29142 ***
[00:00:00.261,138] <inf> main: nRF Cloud multi-service sample has started, version: 1.0.0, protocol: MQTT
[00:00:00.261,169] <inf> application: Reset reason: 0x10001
[00:00:00.261,322] <inf> cloud_connection: Enabling connectivity...
[00:00:00.593,627] <inf> cloud_connection: Setting up nRF Cloud library...
[00:00:00.599,090] <inf> nrf_cloud_info: Device ID: nrf-xxxxxxxxxxxxxxxx
[00:00:00.599,548] <inf> nrf_cloud_info: IMEI: xxxxxxxxxxxxxxxx
[00:00:00.599,945] <inf> nrf_cloud_info: Modem FW: mfw_nrf91x1_2.0.2
[00:00:00.600,006] <inf> nrf_cloud_info: Protocol: MQTT
[00:00:00.600,036] <inf> nrf_cloud_info: Download protocol: HTTPS
[00:00:00.600,067] <inf> nrf_cloud_info: Sec tag: 16842753
[00:00:00.600,097] <inf> nrf_cloud_info: Host name: mqtt.nrfcloud.com
[00:00:01.023,223] <inf> nrf_cloud_credentials: Sec Tag: 16842753; CA: Yes, Client Cert: Yes, Private Key: Yes
[00:00:01.023,284] <inf> nrf_cloud_credentials: CA Size: 1792, AWS: Likely, CoAP: Likely
[00:00:01.023,315] <inf> cloud_connection: Waiting for network ready...
+CGEV: EXCE STATUS 0
+CEREG: 2,"D6E4","0867ED0D",7
%MDMEV: PRACH CE-LEVEL 0
+CSCON: 1
%XTIME: ,"5220027014010A",
+CGEV: ME PDN ACT 0,0
+CNEC_ESM: 50,0
%MDMEV: SEARCH STATUS 2
+CEREG: 1,"D6E4","0867ED0D",7,,,"00001010","10111110"
%XTIME: ,"5220027014110A","00"
[00:00:04.648,010] <inf> cloud_connection: Network connectivity gained!
[00:00:05.648,223] <inf> cloud_connection: Network is ready
[00:00:05.648,254] <inf> cloud_connection: Connecting to nRF Cloud
[00:00:10.263,031] <err> nrf_cloud_transport: MQTT input error: -128
[00:00:10.263,092] <err> nrf_cloud_transport: Error disconnecting from cloud: -128
[00:00:10.263,122] <inf> cloud_connection: Disconnecting from nRF Cloud
[00:00:10.263,183] <err> cloud_connection: Could not connect to nRF Cloud
[00:00:10.263,183] <inf> cloud_connection: Retrying in 30 seconds...
+CSCON: 0

 

CoAP with "overlay_coap.conf":

uart:~$ *** Booting My Application v2.1.0-dev-12e5ee106034 ***
*** Using nRF Connect SDK v2.9.0-7787b2649840 ***
*** Using Zephyr OS v3.7.99-1f8f3dc29142 ***
I: Starting bootloader
I: Primary image: magic=bad, swap_type=0x1, copy_done=0x2, image_ok=0x2
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Image index: 0, Swap type: none
I: Bootloader chainload address offset: 0x10000
[00:00:00.253,448] <inf> spi_nor: gd25wb256e3ir@0: 32 MiBy flash
*** Booting nRF Connect SDK v2.9.0-7787b2649840 ***
*** Using Zephyr OS v3.7.99-1f8f3dc29142 ***
[00:00:00.261,596] <inf> main: nRF Cloud multi-service sample has started, version: 1.0.0, protocol: CoAP
[00:00:00.261,627] <inf> application: Reset reason: 0x10001
[00:00:00.261,810] <inf> cloud_connection: Enabling connectivity...
[00:00:00.594,421] <inf> cloud_connection: Setting up nRF Cloud library...
[00:00:00.597,808] <inf> nrf_cloud_info: Device ID: nrf-xxxxxxxxxxxxxxxx
[00:00:00.598,266] <inf> nrf_cloud_info: IMEI:      xxxxxxxxxxxxxxxx
[00:00:00.683,685] <inf> nrf_cloud_info: UUID:      50333248-3037-4c3b-804e-0a104cb84456
[00:00:00.694,183] <inf> nrf_cloud_info: Modem FW:  mfw_nrf91x1_2.0.2
[00:00:00.694,213] <inf> nrf_cloud_info: Protocol:          CoAP
[00:00:00.694,274] <inf> nrf_cloud_info: Download protocol: HTTPS
[00:00:00.694,274] <inf> nrf_cloud_info: Sec tag:           16842753
[00:00:00.694,305] <inf> nrf_cloud_info: CoAP JWT Sec tag:  16842753
[00:00:00.694,335] <inf> nrf_cloud_info: Host name:         coap.nrfcloud.com
[00:00:01.093,231] <inf> nrf_cloud_credentials: Sec Tag: 16842753; CA: Yes, Client Cert: Yes, Private Key: Yes
[00:00:01.093,292] <inf> nrf_cloud_credentials: CA Size: 1792, AWS: Likely, CoAP: Likely
[00:00:01.093,322] <inf> cloud_connection: Waiting for network ready...
+CGEV: EXCE STATUS 0
+CEREG: 2,"D6E4","0867ED0D",7
%MDMEV: PRACH CE-LEVEL 0
+CSCON: 1
%XTIME: ,"5220027003740A",
+CGEV: ME PDN ACT 0,0
+CNEC_ESM: 50,0
%MDMEV: SEARCH STATUS 2
+CEREG: 1,"D6E4","0867ED0D",7,,,"00001010","10111110"
%XTIME: ,"5220027003740A","00"
[00:00:04.264,099] <inf> cloud_connection: Network connectivity gained!
[00:00:05.264,312] <inf> cloud_connection: Network is ready
[00:00:05.264,343] <inf> cloud_connection: Connecting to nRF Cloud
[00:00:07.442,047] <inf> nrf_cloud_coap_transport: Request authorization with JWT
[00:00:07.720,825] <err> nrf_cloud_coap_transport: Device not authenticated; reconnection required.
[00:00:07.720,855] <inf> nrf_cloud_coap_transport: Authorization result_code: 4.01
[00:00:08.222,351] <err> cloud_connection: Could not connect to nRF Cloud, error: -13
[00:00:08.222,351] <inf> cloud_connection: Retrying in 30 seconds...
[00:00:08.222,412] <err> net_coap: No client found for socket 3
+CSCON: 0
[00:00:38.222,473] <inf> cloud_connection: Waiting for network ready...
[00:00:38.222,503] <inf> cloud_connection: Network is ready
[00:00:38.222,503] <inf> cloud_connection: Connecting to nRF Cloud
%MDMEV: SEARCH STATUS 2
%MDMEV: PRACH CE-LEVEL 0
+CSCON: 1
[00:00:40.627,899] <inf> nrf_cloud_coap_transport: Request authorization with JWT
[00:00:40.887,756] <err> nrf_cloud_coap_transport: Device not authenticated; reconnection required.
[00:00:40.887,786] <inf> nrf_cloud_coap_transport: Authorization result_code: 4.01
[00:00:41.389,617] <err> cloud_connection: Could not connect to nRF Cloud, error: -13
[00:00:41.389,617] <inf> cloud_connection: Retrying in 30 seconds...
[00:00:41.389,709] <err> net_coap: No client found for socket 3
+CSCON: 0
[Disconnected]

I've tried using different sims and also NCS v2.8.0. So far, I've been unable to get successful nRF Cloud connections with MQTT or CoAP except when using the provisioning overlays.

It appears, there others who have run into the same or similar issues.

Regards,
Ravi

[dejans]

Hi Ravi,

Which device did you test nrf_cloud_multi_service sample on?

Which provisioning method did you use?

Which provisioning overlays did you use when building the sample? Can you provide your build commands?

Best regards,
Dejan

[zpm1066]

Hi Dejans,

Thank you for looking at the issue.

I'm using a nRF9131ek that has been provisioned with nRF Cloud with the latest "nRF Cloud Multi-service" app running nRF Connect SDk v2.9.0,

I claimed and on-boarded the nRF9131ek using a verified ATTESTTOKEN, then provisioned with "nRF Cloud Multi-service" using "overlay-http_nrf_provisioning.conf". The provisioning was successful. The device was successful in connecting to nRF Cloud and sending data to it.

I also repeated the provisioning with  "nRF Cloud Multi-service" using "overlay-coap_nrf_provisioning.conf". This was successful in connecting to the nRF Cloud and sending data to it.

After the above provisioning tests, I then re-built "nRF Cloud Multi-service" with no overlay, so it's using MQTT. Running this gave the "MQTT input error: 128". 

On repeating a build of "nRF Cloud Multi-service" with "overlay_coap.conf" and running it gave the error "Device not authenticated".

I have captured a modem trace for the example used in Cellular Fundamentals L09-Ex 6 (MQTT) and  "nRF Cloud Multi-service" with "overlay_coap.conf. Here is a modem trace showing the attempts to connect to nRF Cloud for MQTT.

trace-2025-02-21T15-11-29.435Z.mtrace

Is the issue possibly due to something incorrect with the provisioning of the device? Thanks.

I can also share a modem trace of the device running  "nRF Cloud Multi-service" with MQTT or CoAP.

Regards,
Ravi

[zpm1066]

Hi Dejans,

I accidentally closed this ticket, please re-open it. Thanks.

Sorry for the confusion. When I came across the issue, I was going through "nRF Connect SDK Intermediate" course, Lesson 9 , L9-Ex 6 - FOTA over LTE-M / NB-IoT. This exercise uses a slimmed-down version of "nRF Cloud multi-service" sample to demo FOTA.

https://academy.nordicsemi.com/courses/nrf-connect-sdk-intermediate/lessons/lesson-9-bootloaders-and-dfu-fota/topic/exercise-6-fota-over-lte-m-nb-iot/

Because I ran into issues running  L9-Ex6, I referenced back to "nRF Cloud Multi-service", rebuilding and testing it with MQTT and also with CoAP (using "overlay_coap.conf"). I got the same errors with this as I did with L9-Ex6, unable to connect to nRF Cloud, although the device shows as "Provisioned" in the nRF Cloud.

I have captured two traces. The attached trace is the one with "nRF Cloud multi-service" using MQTT (no additional .conf). I can also provide a trace CoAP using "overlay_coap.conf". 

Did you review the attached trace to see what may be the cause of the issue?

Please let me know if you require additional trace or other info to help with the diagnosis.


Regards,
Ravi

[zpm1066]

Hi Dejan,

I've repeated a connection attempt to nRF Cloud by taking a fresh copy of  "nRF Cloud multi-service" application (https://github.com/nrfconnect/sdk-nrf/tree/main/samples/cellular/nrf_cloud_multi_service), and built it as is, with no additional configuration selection for nRF9131-EK.

On running the application, I get the same error as before.

console output:

 

[00:00:00.688,934] <inf> nrf_cloud_info: Modem FW: mfw_nrf91x1_2.0.2
[00:00:00.688,964] <inf> nrf_cloud_info: Protocol: MQTT
[00:00:00.688,995] <inf> nrf_cloud_info: Download protocol: HTTPS
[00:00:00.689,025] <inf> nrf_cloud_info: Sec tag: 16842753
[00:00:00.689,056] <inf> nrf_cloud_info: Host name: mqtt.nrfcloud.com
[00:00:01.089,263] <inf> nrf_cloud_credentials: Sec Tag: 16842753; CA: Yes, Client Cert: Yes, Private Key: Yes
[00:00:01.089,324] <inf> nrf_cloud_credentials: CA Size: 1792, AWS: Likely, CoAP: Likely
[00:00:01.089,355] <inf> cloud_connection: Waiting for network ready...
+CGEV: EXCE STATUS 0
+CEREG: 2,"D6D8","084ACF01",7
%MDMEV: PRACH CE-LEVEL 0
+CSCON: 1
%XTIME: ,"5220428155140A",
+CGEV: ME PDN ACT 0,0
+CNEC_ESM: 50,0
%MDMEV: SEARCH STATUS 2
+CEREG: 1,"D6D8","084ACF01",7,,,"00001010","10111110"
%XTIME: ,"5220428155240A","00"
[00:00:06.037,384] <inf> cloud_connection: Network connectivity gained!
[00:00:07.037,597] <inf> cloud_connection: Network is ready
[00:00:07.037,628] <inf> cloud_connection: Connecting to nRF Cloud
[00:00:10.946,838] <err> nrf_cloud_transport: MQTT input error: -128
[00:00:10.946,899] <err> nrf_cloud_transport: Error disconnecting from cloud: -128
[00:00:10.946,960] <inf> cloud_connection: Disconnecting from nRF Cloud
[00:00:10.946,990] <err> cloud_connection: Could not connect to nRF Cloud
[00:00:10.946,990] <inf> cloud_connection: Retrying in 30 seconds...

Modem trace:

trace-2025-02-24T19-02-12.831Z.mtrace

I'll try deleting the provisioned device, and then re-claim & provision it again to see if it makes any difference.

Regards,
Ravi

[zpm1066]

Hi Dejan,

I unclaimed device, deleted it, then claimed & re-provisioned successfully with "nRF Cloud Multi-service" & "overlay-http_nrf_provisioning.conf". Device sent device info, temp, etc. successfully to nRF Cloud, as expected.

Rebuilt "nRF Cloud Multi-service" with no additional Kconfig. On execution, device failed to connect to nRF Cloud and got the same errors. An execution of a reuild of "nRF Cloud Multi-service" with "overlay_coap.conf" gave the same errors as before and device was unable to connect to nRF Cloud.

I also tried removing all certificates tag 16842753 from device before unclaiming & re-provisioning the device. Again, provisioning was successful but subsequent MQTT/CoAP builds failed to connect to nRF Cloud.


Regards,
Ravi

[dejans]

Hi Ravi,

There seems to be no support for nrf9131ek device in the nRF Cloud multi service sample. You can look at the sample's requirements. You can find information about supported boards also in the build section of the previously linked exercise 6 of the NCS Intermediate course.

Best regards,
Dejan

[zpm1066]

Hi Dejan,

I do understand that the nRF9131EK isn’t currently a supported device as it hasn’t been released. However, for developers using the EK to assist with their designs based on the nRF9131 SoC, Is there no  technical support provided?

From the modem traces, can you suggest why the nRF9131EK fails to connect to the nRF Cloud. The required certificates are in the device and the nRF Cloud reflects that it has been provisioned successfully. Thanks.

Regards,
Ravi

[Juha Y]

 Hi Ravi,

Provisioning overlays set

CONFIG_NRF_CLOUD_CLIENT_ID_SRC_INTERNAL_UUID=y. So, the device is identified using it's UUID. Default build without overlays use IMEI for identification CONFIG_NRF_CLOUD_CLIENT_ID_SRC_IMEI.

Please add below kconfigs to prj.conf when building the sample without provisioning overlays

CONFIG_MODEM_JWT=y

CONFIG_NRF_CLOUD_CLIENT_ID_SRC_INTERNAL_UUID=y

Best regard,

Juha

 

[zpm1066]

Hi Juha,

Thank you. 

Following your suggestion above to identify the device by its UUID instead of IMEI, I was able to get one of the nRF9131-EK device to successfully connect to the nRF Cloud over MQTT, CoAP and REST.

I was also able to run successfully the "nrf_cloud_rest_cell_location" ,  " nrf_cloud_rest_device_message" , and "nRF Connect SDK Intermediate" course L9-Ex6. The latter is a simplified version of "nRF Cloud Multi-service" with MQTT.

We're more interested in using CoAP DTLS v1.2 CID and REST. Any chance that the team(s) working on the DevAcademy course can add CoAP to L9-Ex6? 

I'm certain it'll assist a lot of folks who are trying to get CoAP working with nRF Cloud and also make the course even more outstanding. Please submit suggestion to the teams working on the courses. Thank you. 

Regards,
Ravi